Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-3462
CVE-2024-3462:
Java vulnerability analysis and mitigation
Overview
CVE-2024-3462 affects Ant Media Server Community Edition, discovered and reported to CERT Polska. The vulnerability was disclosed on May 13, 2024, impacting all versions up to 2.9.0 and potentially newer versions, as the vendor has not confirmed releasing a patch. The vulnerability exists in the default configuration of the software, where improper HTTP header-based authorization can lead to unauthorized access to non-administrative API calls that should be restricted to authorized users only (CERT Polska).
Technical details
The vulnerability is classified as an Authentication Bypass by Assumed-Immutable Data (CWE-302). The CVSS v3.1 base score is 5.4 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. The vulnerability stems from improper validation of HTTP headers in the authentication mechanism, allowing unauthorized users to bypass access controls for non-administrative API functions (NVD).
Impact
A successful exploitation of this vulnerability allows unauthorized users to access and utilize non-administrative API functions that should be restricted to authenticated users only. This could potentially lead to unauthorized access to system features and functionality, though administrative functions remain protected (CERT Polska).
Mitigation and workarounds
As of the disclosure date, no official patch has been confirmed by the vendor. Users of Ant Media Server Community Edition should monitor for security updates and consider implementing additional access controls or authentication mechanisms at the network level (CERT Polska).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management